Red Hat Security Advisory

RHSA-2026:71388

freerdp security update

Released 2026-09-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) freerdp-2:2.4.1-6.el9_2.12, freerdp-libs-2:2.4.1-6.el9_2.12, libwinpr-2:2.4.1-6.el9_2.12

Fixes 4 records

TI-2026-47597 CVE-2026-67301 · GHSA-vpv4-cm44-pgmc

FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy

HIGH 77

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00651 Published 2026-08-01 Fixed in 3.29.0 CWE-125

TI-2026-47587 CVE-2026-67291 · GHSA-qx25-fqx8-cgm7

FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD

HIGH 77

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0041 Published 2026-08-01 Partial fix · 3.29.0 CWE-125

TI-2026-47584 CVE-2026-67288 · GHSA-hq8h-rvcv-jvh4

FreeRDP before 3.29.0 Denial of Service via smartcard cache

HIGH 77

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00426 Published 2026-08-01 Fixed in 3.29.0 CWE-476

TI-2026-39874 CVE-2026-55194

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

HIGH 73

FreeRDP is a free implementation of the Remote Desktop Protocol.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00619 Published 2026-08-19 Fixed in 3.27.0 CWE-122